Privacy Policy

1.About this policy#

This policy explains what personal information Nextstep Legal collects, how we use it, who we share it with, and the rights you have. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Information about your matter is also protected by our duty of confidentiality and, where applicable, legal professional privilege. This policy does not reduce those protections.

In this policy, "we", "us" and "our" mean Nextstep Legal Services Pty Ltd (ABN 62 687 838 393), trading as Nextstep Legal, of Level 1, 41-43 Stewart Street, Richmond VIC 3121.

2.What personal information we collect#

Contact and identity basics. Your name, address, email, phone number and date of birth.

Identity and verification information. Because we are required by law to verify the identity of our clients, we collect government-issued identity documents (for example, your passport or driver licence), and information generated by our identity verification provider, which may include biometric information such as facial recognition data from a selfie matched against your photo ID. We collect biometric information only with your consent and only for identity verification. Our verification partner manages biometric data in accordance with its own published policy.

Financial and transaction information. For conveyancing matters we collect details of your property transaction, mortgage and lender information, bank account details for settlement, and, where the law requires, evidence of your source of funds or wealth (for example, bank statements, gift letters or sale proceeds records).

Payment information. If you pay an invoice by card, or make a payment during onboarding, your card details are processed by our third-party payment processors. We do not store your full card number ourselves.

Matter information. The instructions, documents and correspondence connected with your matter.

Website and technical information. Device information, IP address and usage data when you visit our website or client portal (see section 12).

Job applicants. If you apply to work with us, we collect the information in your application and anything you authorise your referees to tell us.

3.How we collect your information#

We collect information directly from you: through our website and quote forms, our client onboarding flow, email and phone, and the documents you give us. We also collect information from third parties where your matter requires it: for example, from the other side's representatives, your bank or broker, government registries, and the search and certificate providers we order from on your behalf.

4.How we use your information#

We collect, use and disclose your personal information to:

• provide legal services and complete your transaction
• verify your identity and meet our legal obligations (section 5)
• prepare and send quotes, invoices and updates about your matter
• operate and improve our website, portal and services
• send you our own updates and newsletters, which you can opt out of at any time
• consider your application if you apply to work with us
• comply with the law and manage our practice, including if our business is restructured or sold

5.Anti-money laundering and counter-terrorism financing#

As a law practice providing designated services, we have obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). This means we must collect and verify identity information before acting, we may need to collect information about the source of your funds, and we must retain records of these checks for at least 7 years. In some circumstances the law requires us to report information to AUSTRAC and prevents us from telling you that we have done so. We cannot act for clients who do not complete these checks.

6.Who we share your information with#

Our platforms and service providers. We use trusted third-party platforms to deliver our services. Depending on your matter, your information may be processed by: our practice management and client portal systems; our client onboarding, identity verification and anti-money laundering platform; electronic conveyancing and settlement platforms and agents (for example, PEXA and InfoTrack SettleIT); property search and certificate providers; document automation and e-signing platforms; payment processors; our email, document and calendar systems; workflow automation tools; and secure AI tools as described in section 9. A current list of our key providers is available on request.

Referral partners. Where you were referred to us by, or are working with, a real estate agent, mortgage broker or other adviser, we may confirm to them that your matter is progressing and share updates about key milestones (for example, that contracts have been signed or settlement has occurred), unless you ask us not to. We do not share your identity documents or financial information with referral partners. We may pay referral fees to introducers; this is disclosed in our costs agreements.

Others. We may also disclose information to our professional advisers and insurers, to the other parties and representatives involved in your transaction where necessary to progress it, to anyone you authorise, and to courts, regulators and government agencies where the law requires or permits.

We do not sell your personal information.

7.Direct marketing#

We may send you our own updates, newsletters and information about our services by email or SMS. We do not pass your details to other businesses for their marketing. You can opt out at any time using the unsubscribe link or by contacting us.

8.Overseas disclosure#

We may disclose personal information outside Australia to our software and cloud providers, principally in the United States and other jurisdictions where our providers host data. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.

9.How we use AI#

We use secure AI tools to assist with document review, drafting and analysis. We do not use public AI tools that train on your data, and our providers are contractually restricted from using your information to train their models. Some AI processing occurs on infrastructure outside Australia with appropriate safeguards. A qualified lawyer oversees all work, and we remain responsible for the legal services we provide.

10.How long we keep your information#

We keep matter files for at least 7 years after your matter completes, consistent with our professional and anti-money laundering obligations. We then securely delete or de-identify information we no longer need.

11.How we keep your information secure#

We use physical, administrative and technical safeguards to protect personal information from misuse, loss and unauthorised access, including access controls, encryption in transit and reputable cloud providers. No system is perfectly secure, and we cannot guarantee absolute security, but we take the protection of your information seriously and will notify you and the regulator of any eligible data breach as the law requires.

12.Cookies and website analytics#

Our website records usage information such as pages visited, visit timing and IP addresses, and uses cookies to remember preferences and understand how the site is used. You can disable cookies in your browser, though parts of the site may not work as well.

13.Third-party links#

Our website contains links to other websites. We are not responsible for the privacy practices or content of those sites, and their policies may differ substantially from ours.

14.Access and correction#

You can ask for access to the personal information we hold about you, and ask us to correct anything that is inaccurate, out of date or incomplete. Contact us using the details in section 16. We may need to verify your identity first. We will respond within a reasonable period and, if we refuse a request, we will tell you why.

15.Complaints#

If you believe we have breached the Australian Privacy Principles, contact us with your name, contact details and a description of your concern. We will acknowledge your complaint promptly and respond, usually within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

16.Contact us#

• Nextstep Legal Services Pty Ltd (ABN 62 687 838 393)
• Level 1, 41-43 Stewart Street, Richmond VIC 3121
• matt@nextsteplegal.com.au
• 0435 738 050

17.Changes to this policy#

We may update this policy from time to time. The current version is always published on this page, with the version number and effective date shown at the top.